Background. ERISA requires that certain documents be provided to participants and beneficiaries either automatically or upon request. When distributing these materials, the ERISA plan administrator (the “administrator”) must use measures that are “reasonably calculated to ensure actual receipt of the material.” To meet these distribution requirements, the 2002 safe harbor assumed that the default method for sending plan materials would be by paper (e.g., by regular mail or hand delivery). If an administrator wanted to send documents out electronically (e.g., by email or through posting on its intranet website), it would have to (1) determine whether the intended recipient had work-related access to electronic systems (i.e., was “wired at work”), or (2) obtain affirmative consent from the participant or beneficiary to receive documents electronically if the participant was not “wired at work” (e.g., was a COBRA-qualified beneficiary, retiree, worked in manufacturing, etc.).

In its proposed rule, the DOL recognizes that technology and communications have changed substantially since the DOL first published the 2002 safe harbor 20+ years ago. Currently, an increasing share of the public relies on electronic communication and internet-based platforms as their primary method of receiving information. Accordingly, the new safe harbor assumes that the administrator’s default method of document delivery will be electronic (e.g., through posting on an internet website), instead of by paper copy. The rules are meant to ease the administrative burden faced by administrators when distributing group health plan documents and notices.

Note: The new safe harbor is optional and administrators have the option of either utilizing the 2002 safe harbor, or the new safe harbor when distributing group health plan materials electronically.

Which plans are subject to the new electronic disclosure requirements? This new safe harbor applies to ERISA group health plans (e.g., medical, dental, vision, employee assistance program, etc.). The proposed rule clarifies that the new safe harbor would not apply to ERISA welfare benefit plans (e.g., life insurance, disability, accidental death and dismemberment, prepaid legal services, etc.).

Note: Plan sponsors frequently create plan documents and notices that cover both group health and welfare benefit plans. For example, ERISA wrap plan summary plan descriptions include both group health plan and welfare benefit plan related information. We will need further guidance regarding whether documents such as ERISA wrap plan documents may be electronically delivered under the new safe harbor, or whether they will have to meet the 2002 safe harbor requirements as well.

 What types of ERISA group health plan documents may be electronically disclosed using the new safe harbor? The new safe harbor may be used by a plan sponsor when distributing its ERISA-required group health plan documents and notices. Group health plans are subject to a variety of notice and distribution requirements. For example, these notices include summary plan descriptions, summary of material modifications, plan documents, COBRA notices, HIPAA special enrollment notices, Newborns’ and Mothers’ Health Protection Act notices, Women’s Health and Cancer Rights Act notices, and claim denial notices. An administrator may use the new safe harbor when distributing these types of group health plan materials.

Note: This new safe harbor applies to documents the plan administrator has an affirmative obligation to furnish (e.g., ERISA summary of material modifications, annual legal notices, etc.), as well as those documents that must be furnished only upon request (e.g., the ERISA wrap plan document).

Who is a covered individual? A plan administrator may electronically distribute required ERISA group health plan notices under the new safe harbor to “covered individuals.” The proposed rule describes a “covered individual” as a participant or beneficiary who has provided the employer, plan sponsor, or administrator with an email address or smartphone number (e.g., using Short Message Service). This information should be collected by the employer when the individual enrolls in the group health plan. The email address could include the employee’s assigned work email address.

Note: The proposed rule reflects that dependent children who have reached age 18 should have the right to independently receive ERISA group health plan-related documents. If such a dependent child has provided the employer, plan administrator, or plan sponsor with their electronic address, then the administrator may use the new safe harbor when electronically distributing group health plan materials to the dependent.

Electronic delivery method. Under the new safe harbor, group health plan documents may be distributed by posting these documents on an internet website where the covered individual is able to access the document. When posting on the website, the administrator must meet the following requirements:

• • Documents must be timely posted. Each covered document must be available on the website no later than the date it is legally required to be provided to participants.
  • Documents must stay up for at least a year. Covered documents must remain on the website for at least one year to allow covered individuals a reasonable window to review their plan materials.
  • Document must be written clearly. The covered document must be written in a manner calculated to be understood by the average plan participant.
  • Document must be in a format that is readable. The document must be posted in a format that is suitable to be both read online and printed clearly on paper (e.g., in PDF format).
  • Document must be searchable. A covered individual must be able to search the covered document electronically by numbers, letters or words. For example, a scanned document where a participant could not search by letters or words would not satisfy this requirement.
  • Document must be saveable. The document must be in a format that allows the covered individual to download and save a copy of the covered document for their records.
  • Website must be secure. The administrator must take reasonable steps to ensure that the website protects the covered individual’s personal information.
  • The proposed rule defines the type of “website” where covered documents may be posted broadly to include an “internet website” or “other internet-based information repository, such as a mobile app.” The website must be available to covered individuals at work as well as outside of the workplace (e.g., at home).

Note: The administrator is responsible for establishing and maintaining the internet website. However, the proposed rule recognizes that employers have existing administrative arrangements in which third party administrators (TPAs) host participant-facing portals and document repositories for the plans they assist with administering. Employers will need to coordinate and confirm with their TPAs that they are complying with these new electronic safe harbor requirements.

Note Further: The proposed rule only anticipates that an administrator will use an internet website to distribute plan materials. Unlike the 2002 safe harbor, the new safe harbor does not include email as an alternative method of group health plan document distribution because of concern that group health plan materials may include protected health information that cannot be securely sent via email.

Initial notification required before new safe harbor may be used. Before relying on the new safe harbor, the administrator must provide an “initial notice” of electronic delivery to covered individuals. This notice serves as a “heads up” to individuals of the plan’s electronic delivery procedures. The notice will need to contain the following information:

• • Notice of electronic delivery. A statement that covered documents will be furnished electronically;
  • Identification of the email address. The notice must identify the electronic address that will be used for the individual.
  • Instructions. Any instructions necessary to access the covered documents;
  • Statement regarding how long documents will be posted. A warning that covered documents are not required to be available on the company website for more than one year or, if later, after it is superseded by a subsequent version of the covered document;
  • Right to paper copy. A statement of the individual’s right to request and obtain a paper version of the document free of charge, and an explanation of how to exercise this right; and
  • Right to opt out. A statement of the right to opt out of electronic delivery and receive only paper versions of the covered documents.

Note: Participants and beneficiaries for whom the administrator intends to use electronic delivery must receive a paper copy of this initial notice before any covered documents are delivered electronically using this new safe harbor. However, the proposed rule contemplates whether a paper copy of the initial notice is necessary for covered individuals already receiving plan materials electronically under the requirements of the 2002 safe harbor, and the DOL has solicited comments on this issue. We anticipate that the final rule will address this open issue.

Notice of Internet Availability. Before posting a covered document on its internet website, the administrator must provide covered individuals with a Notice of Internet Availability (NOIA). This notice must be distributed to the email address or cell phone number provided by the covered individual. Further, the NOIA must meet the following requirements:

• • A title or subject line that reads, “Disclosure About Your Health Plan.”
  • A separate statement reading, “Important information about your health plan is now available. Please review this information.”
  • Identify the covered document that is being posted by name (e.g., “Your Notice of HIPAA Special Enrollment Rights is now available.”).
  • Include the internet address (or hyperlink) where the covered document is posted.
  • Describe the covered individual’s right to request and obtain a paper copy of the covered document free of charge.
  • Explain the covered individual’s right to opt out of electronic delivery and receive only paper copies of the covered documents.
  • Include a cautionary statement that the covered document is only required to be posted on the website for one year.
  • Provide a telephone number to contact the administrator or other designated representative of the plan.

As a general rule, a separate NOIA must be furnished each time a covered document is posted on the administrator’s internet website (for example, a NOIA must be furnished before the administrator posts on its website a mid-year ERISA summary of material modifications). However, the proposed rule provides exceptions to this general rule where one NOIA may be provided describing the posting of multiple covered documents. For example, the NOIA may be provided at open enrollment and describe the posting of the ERISA group health plan’s annual required ERISA group health plan notices.

Note: The combined NOIA is an exception to the stand-alone rule and is limited to recurring annual disclosures that do not demand time-sensitive participant action. For example, if the administrator plans on posting a COBRA election form online, it must send the COBRA qualifying beneficiary a stand-alone NOIA notifying the participant of the COBRA election form posting.

Invalid addresses. If the administrator is alerted that a covered individual’s email address has become invalid (e.g., because the NOIA is returned as undeliverable), the administrator must take steps to cure the problem. For example, the administrator should obtain a new email address for the covered individual where the NOIA can be properly delivered.

Severance from employment. When a covered individual terminates employment with the employer, the employer will need to take steps to make sure it has an up-to-date email address for the terminating employee. For example, if the individual will no longer have access to a company email address, the employer will need to obtain the individual’s personal email address to ensure that the covered individual has the ability to receive covered documents post-employment.

Comments on the proposed rule are due by September 21, 2026. If the proposed rule is finalized in its current form, the new safe harbor would become effective as of the first day of the first calendar year following publication of the final rule in the Federal Register.

Next steps. We will continue to monitor developments and provide updates as the DOL finalizes the safe harbor rules for electronic delivery of group health plan notices and disclosures. Please contact us if you have any questions about the proposed rule or how it may impact your group health plan practices.